@oxyhq/services 16.0.0 → 18.0.0

package/src/ui/hooks/useSwitchableAccounts.ts

@@ -1,397 +1,63 @@
-import { useMemo } from 'react';
-import { useQuery } from '@tanstack/react-query';
-import {
-    getAccountDisplayName,
-    getAccountFallbackHandle,
-} from '@oxyhq/core';
-import type {
-    User,
-    AccountNode,
-    AccountRelationship,
-    AccountKind,
-    AccountMember,
-} from '@oxyhq/core';
+import { useCallback, useMemo, useSyncExternalStore } from 'react';
+import type { SwitchableAccount, AccountDialogSnapshot } from '@oxyhq/core';
 import { useOxy } from '../context/OxyContext';
-import { useI18n } from './useI18n';
-import { queryKeys } from './queries/queryKeys';
-
-/**
- * The per-account user shape carried by a {@link SwitchableAccount}. The SDK's
- * canonical {@link User} document — either the freshest `useOxy().user` (the
- * active row), a profile resolved via `oxyServices.getUsersByIds()` (every other
- * device row), or the `account` document embedded in an account-graph node.
- */
-export type SwitchableAccountUser = User;
-
-/**
- * One account the signed-in user can switch INTO, in the uniform switch model.
- *
- * A switchable account is either a device sign-in, an account-graph node (owned
- * org / shared-with-you), or BOTH (an account that has been switched into
- * becomes a device session while still being a graph node — the two are deduped
- * into a single row). Every row carries a canonical `accountId` (the uniform
- * switch key passed to `switchToAccount`); `sessionId` is present IFF the
- * account is currently signed in on THIS device.
- */
-export interface SwitchableAccount {
-    /**
-     * Canonical account id (the underlying `User._id`). The single key EVERY
-     * switch uses — `switchToAccount(accountId)`. Always present.
-     */
-    accountId: string;
-    /**
-     * Device session id, present IFF this account is signed in on THIS device.
-     * Absent for a graph account not yet switched into. Used only for
-     * device-scoped actions (per-account sign-out via `removeSession`); switching
-     * ALWAYS goes through `switchToAccount(accountId)`.
-     */
-    sessionId?: string;
-    /**
-     * Device-local refresh-cookie slot index (0..N-1), when the underlying
-     * `ClientSession` carries one (web silent-switch). Absent on native and for
-     * graph-only rows.
-     */
-    authuser?: number;
-    /** Whether this account is the currently-active one. */
-    isCurrent: boolean;
-    /** Whether this account is signed in on THIS device (has a `sessionId`). */
-    onDevice: boolean;
-    /**
-     * The caller's relationship to this account when it appears in the account
-     * graph: `self` (the caller's own personal account), `owner` (an org/project/
-     * bot the caller owns), or `member` (shared with the caller). Absent for an
-     * independent device sign-in that is NOT in the active account's graph.
-     */
-    relationship?: AccountRelationship;
-    /** Account classification (personal/organization/…). Cosmetic badge only. */
-    kind?: AccountKind;
-    /** Parent account id for 2-level tree grouping, or `null` for a root. */
-    parentAccountId?: string | null;
-    /**
-     * The caller's effective membership (role + permissions) in this account when
-     * it appears in the graph, or `null`/absent otherwise. Use `permissions` to
-     * gate per-account settings UI.
-     */
-    callerMembership?: AccountMember | null;
-    /** Friendly display name (never blank — falls back to a handle/sentinel). */
-    displayName: string;
-    /**
-     * Real account email, or `null` when the account genuinely has none. NEVER a
-     * synthesized `username@oxy.so` — a missing email falls back to the `@handle`
-     * secondary line.
-     */
-    email: string | null;
-    /** Resolved avatar thumbnail URL, or `undefined` when the account has no avatar. */
-    avatarUrl?: string;
-    /** Account's preferred Bloom color preset, or `null` when unset. */
-    color: string | null;
-    /** The underlying per-account user payload. */
-    user: SwitchableAccountUser;
-}
 
 export interface UseSwitchableAccountsResult {
     /** Every switchable account (device sign-ins + linked graph accounts). */
     accounts: SwitchableAccount[];
-    /** True until the per-device-account profile fetch settles. */
+    /** True until the initial account-list fetch settles with no data yet. */
     isLoading: boolean;
-    /** The currently-active session id (mirrors `useOxy().activeSessionId`). */
+    /** The currently-active account's device session id, or `null`. */
     currentSessionId: string | null;
 }
 
-/** The minimal device-session shape {@link buildSwitchableAccounts} reads. */
-export interface SwitchableSessionInput {
-    sessionId: string;
-    userId?: string;
-    authuser?: number;
-}
-
-export interface BuildSwitchableAccountsInput {
-    /** Device sessions projected from the server-authoritative `SessionClient`. */
-    sessions: SwitchableSessionInput[];
-    /** The currently-active session id. */
-    activeSessionId: string | null;
-    /** The freshest copy of the active account's user (`useOxy().user`). */
-    liveUser: User | null;
-    isAuthenticated: boolean;
-    /** The account graph under the active account (`useOxy().accounts`). */
-    graph: AccountNode[];
-    /** Per-device-account profiles resolved via `getUsersByIds()`, keyed by id. */
-    profilesById: Map<string, User>;
-    locale: string;
-    /** Resolves a file id to a thumbnail URL (bound to `getFileDownloadUrl`). */
-    resolveAvatarUrl: (avatar: string | null | undefined) => string | undefined;
-}
-
-/**
- * Resolve which entries are the current account, robustly.
- *
- * Primary signal: `entry.sessionId === activeSessionId` — both are projected
- * from the same `SessionClient` state, so this normally matches exactly.
- * Fallbacks exist only to bridge the brief window between the two sequential
- * `updateSessions` / `setActiveSessionId` calls in `OxyContext.syncFromClient`,
- * applied only when the `sessionId` match found nothing AND the user is
- * authenticated:
- *  1. Match the live `user.id` against each entry's per-account user id.
- *  2. If still nothing and there is exactly one account, mark that one current.
- *
- * At most ONE entry is ever marked current. Runs over DEVICE rows only (graph
- * rows are never active — the active account is always a device session), so the
- * single-account fallback counts device rows.
- *
- * Pure & side-effect free so it is unit-testable without rendering React.
- */
-export function markCurrentAccount(
-    accounts: SwitchableAccount[],
-    activeSessionId: string | null | undefined,
-    liveUserId: string | null | undefined,
-    isAuthenticated: boolean,
-): SwitchableAccount[] {
-    const bySession = accounts.map((account): SwitchableAccount => ({
-        ...account,
-        isCurrent: Boolean(activeSessionId) && account.sessionId === activeSessionId,
-    }));
-
-    if (bySession.some((account) => account.isCurrent) || !isAuthenticated) {
-        return bySession;
-    }
-
-    // No row matched by session id: fall back to the live user's id, marking at
-    // most the FIRST matching entry current (never more than one).
-    if (liveUserId) {
-        let matched = false;
-        const byUser = bySession.map((account): SwitchableAccount => {
-            if (!matched && account.user.id === liveUserId) {
-                matched = true;
-                return { ...account, isCurrent: true };
-            }
-            return account;
-        });
-        if (matched) {
-            return byUser;
-        }
-    }
-
-    // Authenticated, nothing matched, but there is exactly one account → it must
-    // be the current one.
-    if (bySession.length === 1) {
-        return [{ ...bySession[0], isCurrent: true }];
-    }
-
-    return bySession;
-}
-
 /**
- * Pure union of device sign-ins and account-graph nodes into the flat
- * {@link SwitchableAccount}[] the switchers render. Extracted so the merge /
- * dedup semantics are unit-testable without rendering React.
- *
- * Order: device rows first (in session order, current flagged), then graph-only
- * rows (in graph order). An account present as BOTH a device session and a graph
- * node is deduped into ONE device row enriched with the graph metadata
- * (relationship / kind / parent / membership).
+ * Stable empty snapshot for the no-provider loading state, so `useSyncExternalStore`
+ * always has a getSnapshot that returns a constant reference before mount.
  */
-export function buildSwitchableAccounts(input: BuildSwitchableAccountsInput): SwitchableAccount[] {
-    const {
-        sessions,
-        activeSessionId,
-        liveUser,
-        isAuthenticated,
-        graph,
-        profilesById,
-        locale,
-        resolveAvatarUrl,
-    } = input;
-
-    // Nothing is switchable when signed out — never surface a lingering device
-    // session or graph node once the user is unauthenticated.
-    if (!isAuthenticated) {
-        return [];
-    }
-
-    const toRow = (
-        accountUser: User,
-        opts: {
-            sessionId?: string;
-            authuser?: number;
-            relationship?: AccountRelationship;
-            kind?: AccountKind;
-            parentAccountId?: string | null;
-            callerMembership?: AccountMember | null;
-        },
-    ): SwitchableAccount => {
-        const displayName = getAccountDisplayName(accountUser, locale);
-        const handle = getAccountFallbackHandle(accountUser);
-        const secondaryHandle = handle ? `@${handle}` : null;
-        return {
-            accountId: accountUser.id?.toString() ?? '',
-            sessionId: opts.sessionId,
-            authuser: opts.authuser,
-            isCurrent: Boolean(opts.sessionId) && opts.sessionId === activeSessionId,
-            onDevice: Boolean(opts.sessionId),
-            relationship: opts.relationship,
-            kind: opts.kind,
-            parentAccountId: opts.parentAccountId,
-            callerMembership: opts.callerMembership,
-            displayName,
-            // Real email, or the `@handle` fallback (NEVER synthesized).
-            email: accountUser.email ?? secondaryHandle,
-            avatarUrl: resolveAvatarUrl(accountUser.avatar),
-            color: accountUser.color ?? null,
-            user: accountUser,
-        };
-    };
-
-    // --- Device rows ---
-    const built = sessions.flatMap((session): SwitchableAccount[] => {
-        const isCurrent = session.sessionId === activeSessionId;
-        // The active row always uses the live `user` — freshest available —
-        // regardless of whether the batch profile fetch has resolved yet.
-        const accountUser: User | undefined = isCurrent && liveUser
-            ? liveUser
-            : (session.userId ? profilesById.get(session.userId) : undefined);
-        if (!accountUser) {
-            return [];
-        }
-        return [toRow(accountUser, { sessionId: session.sessionId, authuser: session.authuser })];
-    });
-
-    const flagged = markCurrentAccount(built, activeSessionId, liveUser?.id ?? null, isAuthenticated);
-
-    // The signed-in user must ALWAYS be represented, even before the device
-    // session set has synced (e.g. immediately after cold boot). Synthesize a
-    // single current row from the live `useOxy().user` in that case.
-    const deviceRows = flagged.length === 0 && isAuthenticated && liveUser && activeSessionId
-        ? [toRow(liveUser, { sessionId: activeSessionId })]
-        : flagged;
-
-    // --- Merge graph nodes, deduping by account id ---
-    const byAccountId = new Map<string, SwitchableAccount>();
-    const order: string[] = [];
-    const remember = (row: SwitchableAccount): void => {
-        if (!row.accountId || byAccountId.has(row.accountId)) {
-            return;
-        }
-        byAccountId.set(row.accountId, row);
-        order.push(row.accountId);
-    };
-
-    for (const row of deviceRows) {
-        remember(row);
-    }
-
-    for (const node of graph) {
-        const existing = byAccountId.get(node.accountId);
-        if (existing) {
-            // On-device account that is ALSO in the graph: enrich the device row
-            // with graph metadata; keep its (freshest) profile + sessionId.
-            byAccountId.set(node.accountId, {
-                ...existing,
-                relationship: node.relationship,
-                kind: node.kind,
-                parentAccountId: node.parentAccountId,
-                callerMembership: node.callerMembership,
-            });
-            continue;
-        }
-        // Graph-only account (owned org / shared, not yet a device session).
-        remember(toRow(node.account, {
-            relationship: node.relationship,
-            kind: node.kind,
-            parentAccountId: node.parentAccountId,
-            callerMembership: node.callerMembership,
-        }));
-    }
-
-    return order.flatMap((id) => {
-        const row = byAccountId.get(id);
-        return row ? [row] : [];
-    });
-}
+const EMPTY_SNAPSHOT: AccountDialogSnapshot = {
+    view: 'accounts',
+    accounts: [],
+    activeAccountId: null,
+    loading: false,
+    error: null,
+    switchingAccountId: null,
+    signIn: { phase: 'idle', authorizeCode: null, qrPayload: null, expiresAt: null, error: null },
+};
 
 /**
- * Resolve every account the signed-in user can switch into — device sign-ins
- * AND linked graph accounts (owned orgs + shared-with-you) — as one flat list
- * with real per-account name / email / avatar / color, deduped by account id.
- *
- * ## Data sources
- *
- * - Device sign-ins: `useOxy().sessions` — a `ClientSession[]` projected by
- *   `OxyContext.syncFromClient` from the server-authoritative `SessionClient`.
- *   Each session carries only `sessionId` + `userId`, so this hook additionally
- *   fetches every device account's profile via `oxyServices.getUsersByIds()`.
- *   The ACTIVE row always uses `useOxy().user` directly (the freshest copy).
- * - Linked accounts: `useOxy().accounts` — the `AccountNode[]` graph the context
- *   loads from `GET /accounts`. Each node already embeds its `account` `User`
- *   document, so graph-only rows need no extra fetch.
- *
- * An account present as BOTH a device session and a graph node is deduped into
- * ONE row (see {@link buildSwitchableAccounts}). EVERY row switches the same
- * way — through `useOxy().switchToAccount(row.accountId)`.
- *
- * ## Error handling
- *
- * `getUsersByIds()` resolves to `[]` on a failed chunk (logged internally)
- * rather than throwing. Device accounts whose profile could not be resolved are
- * omitted until a subsequent fetch succeeds (except the active one, which never
- * depends on this fetch); graph accounts are unaffected.
+ * Every account the signed-in user can switch into — device sign-ins AND linked
+ * graph accounts (owned orgs + shared-with-you) — as one flat, deduped list with
+ * real per-account name / email / avatar / color.
+ *
+ * This is a thin binding over the shared `AccountDialogController` in
+ * `@oxyhq/core` (the SAME headless source the {@link OxyAccountDialog} renders),
+ * so there is ONE projection (`projectSwitchableAccounts`) and one switch path
+ * (`controller.switchTo`) across the whole SDK — the local duplicate projection
+ * this hook used to own has been removed. Every switch routes through
+ * `useOxy().switchToAccount(accountId)` (or the dialog's row press).
  */
 export function useSwitchableAccounts(): UseSwitchableAccountsResult {
-    const {
-        oxyServices,
-        sessions,
-        activeSessionId,
-        user,
-        isAuthenticated,
-        accounts: graph,
-    } = useOxy();
-    const { locale } = useI18n();
+    const { accountDialogController: controller } = useOxy();
 
-    // Every distinct account id carried by the device's session set, sorted for
-    // a stable query key regardless of session ordering.
-    const accountIds = useMemo<string[]>(() => {
-        const ids = new Set<string>();
-        for (const session of sessions ?? []) {
-            if (session.userId) {
-                ids.add(session.userId);
-            }
-        }
-        return Array.from(ids).sort();
-    }, [sessions]);
-
-    const profilesQuery = useQuery({
-        queryKey: queryKeys.users.list(accountIds),
-        queryFn: () => oxyServices.getUsersByIds(accountIds),
-        enabled: isAuthenticated && accountIds.length > 0,
-        staleTime: 5 * 60 * 1000, // 5 minutes — matches useUserProfile's convention
-        gcTime: 30 * 60 * 1000, // 30 minutes
-    });
-
-    const profilesById = useMemo<Map<string, User>>(() => {
-        const map = new Map<string, User>();
-        for (const profile of profilesQuery.data ?? []) {
-            map.set(profile.id, profile);
-        }
-        return map;
-    }, [profilesQuery.data]);
-
-    const accounts = useMemo<SwitchableAccount[]>(
-        () => buildSwitchableAccounts({
-            sessions: sessions ?? [],
-            activeSessionId: activeSessionId ?? null,
-            liveUser: user ?? null,
-            isAuthenticated,
-            graph: graph ?? [],
-            profilesById,
-            locale,
-            resolveAvatarUrl: (avatar) =>
-                (avatar ? oxyServices.getFileDownloadUrl(avatar, 'thumb') : undefined),
-        }),
-        [sessions, activeSessionId, user, isAuthenticated, graph, profilesById, locale, oxyServices],
+    const subscribe = useCallback(
+        (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
+        [controller],
     );
+    const getSnapshot = useCallback(
+        () => (controller ? controller.getSnapshot() : EMPTY_SNAPSHOT),
+        [controller],
+    );
+    const snapshot = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+
+    const currentSessionId = useMemo<string | null>(() => {
+        const active = snapshot.accounts.find((account) => account.accountId === snapshot.activeAccountId);
+        return active?.sessionId ?? null;
+    }, [snapshot]);
 
     return {
-        accounts,
-        isLoading: isAuthenticated && accountIds.length > 0 && profilesQuery.isLoading,
-        currentSessionId: activeSessionId ?? null,
+        accounts: snapshot.accounts,
+        isLoading: snapshot.loading,
+        currentSessionId,
     };
 }

package/src/ui/index.ts

@@ -21,16 +21,14 @@ export { default as OxySignInButton } from './components/OxySignInButton';
 export { default as OxyAuthPrompt } from './components/OxyAuthPrompt';
 export type { OxyAuthPromptProps } from './components/OxyAuthPrompt';
 export { default as OxyLogo } from './components/OxyLogo';
+export { RequireOxyAuth } from './components/RequireOxyAuth';
+export type { RequireOxyAuthProps, RequireOxyAuthPrompt } from './components/RequireOxyAuth';
 export { default as Avatar } from './components/Avatar';
 export { default as FollowButton } from './components/FollowButton';
 export { default as OxyPayButton } from './components/OxyPayButton';
 export { FontLoader, setupFonts } from './components/FontLoader';
 export { default as OxyIcon } from './components/icon/OxyIcon';
-export { default as AccountMenu } from './components/AccountMenu';
-export { default as AccountMenuButton } from './components/AccountMenuButton';
 export { default as ProfileButton } from './components/ProfileButton';
-export { default as ProfileMenu } from './components/ProfileMenu';
-export { default as AccountSwitcher, AccountSwitcherView } from './components/AccountSwitcher';
 
 // Context + hooks
 export { useOxy } from './context/OxyContext';
@@ -42,7 +40,6 @@ export type { UseStorageOptions, UseStorageResult } from './hooks/useStorage';
 // Screens
 export { default as ProfileScreen } from './screens/ProfileScreen';
 export { default as ManageAccountScreen } from './screens/ManageAccountScreen';
-export { default as AccountSwitcherScreen } from './screens/AccountSwitcherScreen';
 export { default as CreateAccountScreen } from './screens/CreateAccountScreen';
 export { default as AccountMembersScreen } from './screens/AccountMembersScreen';
 export { default as AccountSettingsScreen } from './screens/AccountSettingsScreen';

package/src/ui/navigation/accountDialogManager.ts

@@ -0,0 +1,84 @@
+/**
+ * Imperative bridge for the unified {@link OxyAccountDialog}.
+ *
+ * Mirrors `bottomSheetManager` — a tiny module-level indirection so any caller
+ * (even outside React, e.g. an app's imperative "sign in" handler) can open the
+ * single account dialog without a ref. `OxyContext` registers the live open/close
+ * controls on mount via {@link registerAccountDialogControls} and reports the
+ * dialog's visibility here via {@link notifyAccountDialogVisibility}; the exported
+ * `openAccountDialog` / `closeAccountDialog` drive those controls.
+ *
+ * `showSignInModal` / `hideSignInModal` / `subscribeToSignInModal` are the stable
+ * public surface the previous `SignInModal` module owned — kept so existing
+ * consumers (inbox, accounts) keep working while the sign-in surface is now the
+ * unified dialog opened on its `signin` view.
+ */
+
+import type { AccountDialogView } from '@oxyhq/core';
+
+/** Live open/close handles registered by the mounted provider. */
+export interface AccountDialogControls {
+  open: (view?: AccountDialogView) => void;
+  close: () => void;
+}
+
+let controls: AccountDialogControls | null = null;
+const visibilityListeners = new Set<(visible: boolean) => void>();
+
+/**
+ * Register the provider's live open/close controls. Returns an unregister
+ * function that only clears the slot if it still owns it (guards against a late
+ * unmount clobbering a newer provider).
+ */
+export function registerAccountDialogControls(next: AccountDialogControls): () => void {
+  controls = next;
+  return () => {
+    if (controls === next) {
+      controls = null;
+    }
+  };
+}
+
+/** Open the account dialog on `view` (default `accounts`). No-op before mount. */
+export function openAccountDialog(view?: AccountDialogView): void {
+  controls?.open(view);
+}
+
+/** Close the account dialog. No-op before mount. */
+export function closeAccountDialog(): void {
+  controls?.close();
+}
+
+/**
+ * Report the dialog's current visibility so subscribers (e.g. `OxySignInButton`)
+ * can reflect an in-flight "Signing in…" state. Called by the provider whenever
+ * the open flag changes, so listeners stay accurate regardless of what triggered
+ * the change (imperative open, backdrop dismiss, completed sign-in).
+ */
+export function notifyAccountDialogVisibility(visible: boolean): void {
+  for (const listener of visibilityListeners) {
+    listener(visible);
+  }
+}
+
+/**
+ * Subscribe to dialog visibility changes. Returns an unsubscribe function.
+ * Retains the name the old `SignInModal` exposed so `OxySignInButton` keeps its
+ * "Signing in…" affordance.
+ */
+export function subscribeToSignInModal(listener: (visible: boolean) => void): () => void {
+  visibilityListeners.add(listener);
+  return () => {
+    visibilityListeners.delete(listener);
+  };
+}
+
+/** Open the unified dialog on its sign-in view. Public back-compat entry point. */
+export function showSignInModal(): void {
+  openAccountDialog('signin');
+}
+
+/** Close the unified dialog. Public back-compat entry point. */
+export function hideSignInModal(): void {
+  closeAccountDialog();
+}

package/src/ui/navigation/routes.ts

@@ -7,7 +7,6 @@ import type { BaseScreenProps } from '../types/navigation';
 
 // Define all available route names
 export type RouteName =
-    | 'OxyAuth'          // Sign in with Oxy (QR code / deep link to Accounts app)
     | 'ManageAccount'    // Unified "Manage your Oxy Account" surface
     | 'AccountVerification'
     | 'PaymentGateway'
@@ -37,7 +36,6 @@ export type RouteName =
     | 'TrustFAQ'
     | 'FollowersList'  // List of user's followers
     | 'FollowingList' // List of users being followed
-    | 'AccountSwitcher' // Unified account switcher (device sign-ins + account graph)
     | 'CreateAccount' // Create a new account (organization / project / bot)
     | 'AccountMembers' // Manage an account's members (invite / roles / transfer)
     | 'AccountSettings' // Per-account profile edit + members + danger zone
@@ -49,7 +47,6 @@ export type RouteName =
 // Lazy screen loaders - functions that return screen components on-demand
 // This breaks the require cycle by deferring imports until screens are actually needed
 const screenLoaders: Record<RouteName, () => ComponentType<BaseScreenProps>> = {
-    OxyAuth: () => require('../screens/OxyAuthScreen').default,
     ManageAccount: () => require('../screens/ManageAccountScreen').default,
     AccountVerification: () => require('../screens/AccountVerificationScreen').default,
     PaymentGateway: () => require('../screens/PaymentGatewayScreen').default,
@@ -82,7 +79,6 @@ const screenLoaders: Record<RouteName, () => ComponentType<BaseScreenProps>> = {
     // User list screens (followers/following)
     FollowersList: () => require('../screens/FollowersListScreen').default,
     FollowingList: () => require('../screens/FollowingListScreen').default,
-    AccountSwitcher: () => require('../screens/AccountSwitcherScreen').default,
     CreateAccount: () => require('../screens/CreateAccountScreen').default,
     AccountMembers: () => require('../screens/AccountMembersScreen').default,
     AccountSettings: () => require('../screens/AccountSettingsScreen').default,

package/src/ui/screens/ManageAccountScreen.tsx

@@ -78,7 +78,7 @@ const formatRelative = (dateString?: string): string => {
  * Replaces AccountOverview + AccountSettings + the per-account half of
  * SessionManagement. Lists ONLY the active user's profile, sessions on this
  * device, and security/destructive actions for THIS account. Multi-account
- * surface lives in {@link AccountSwitcher} — keep these concerns separate.
+ * surface lives in the unified `OxyAccountDialog` — keep these concerns separate.
  */
 const ManageAccountScreen: React.FC<BaseScreenProps> = ({
     onClose,
@@ -95,6 +95,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
         logout,
         openAvatarPicker,
         accounts,
+        openAccountDialog,
     } = useOxy();
 
     const { data: userFromQuery, isLoading: userLoading } = useCurrentUser({
@@ -700,7 +701,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
                                         || 'Accounts you own or share'
                                     )
                             }
-                            onPress={() => navigate?.('AccountSwitcher')}
+                            onPress={() => openAccountDialog('accounts')}
                         />
                         <SettingsListItem
                             icon={

package/src/ui/session/createSessionClient.ts

@@ -4,6 +4,7 @@ import {
   createSessionClientHost,
   type AuthStateStore,
   type OxyServices,
+  type SessionClientOptions,
 } from '@oxyhq/core';
 import { createTokenTransport } from './tokenTransport';
 
@@ -31,12 +32,19 @@ export function createSessionClient(
   oxyServices: OxyServices,
   store: AuthStateStore,
   onUnauthenticated?: () => void,
+  /**
+   * Optional signed-out realtime wiring: `signedOutSocketAuth` (open the socket
+   * while signed out — web returns `true` to ride the `oxy_device` cookie,
+   * native returns the shared device token) and `onSessionAppeared` (self-acquire
+   * when a sibling signs in on this device).
+   */
+  extra?: Pick<SessionClientOptions, 'signedOutSocketAuth' | 'onSessionAppeared'>,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
   const host = createSessionClientHost(oxyServices);
   const transport = createTokenTransport(oxyServices, store);
-  const client = new SessionClient(host, { transport, socketFactory: io, onUnauthenticated });
+  const client = new SessionClient(host, { transport, socketFactory: io, onUnauthenticated, ...extra });
   return { client, host };
 }

package/src/ui/types/navigation.ts

@@ -63,4 +63,31 @@ export interface OxyProviderProps {
     authWebUrl?: string;
     authRedirectUri?: string;
     queryClient?: QueryClient;
+    /**
+     * Convenience: wrap the whole app subtree in `<RequireOxyAuth prompt=...>`.
+     * `off` (default) renders children unconditionally; `soft` adds a dismissible
+     * sign-in banner while signed out; `hard` blocks the app behind the signed-out
+     * wall until the user signs in. For finer control, mount `RequireOxyAuth`
+     * yourself around a specific subtree instead.
+     * @default 'off'
+     */
+    requireAuth?: 'off' | 'soft' | 'hard';
+    /**
+     * Whether this provider acts as the ecosystem's device-first **session
+     * authority**. `true` (default) runs the full device-first cold boot on
+     * mount (bootstrap-return → stored tokens → shared key / bootstrap hop) and
+     * opens the signed-out device-state socket so an idle tab self-acquires when
+     * a sibling signs in — the correct behavior for every Relying Party app.
+     *
+     * Set `false` for the **IdP host** (`auth.oxy.so`): the IdP is NOT a session
+     * authority (see the handoff "IdP vs RP" section). With `coldBoot={false}`
+     * the provider skips `runSessionColdBoot` entirely and never opens the
+     * signed-out device socket — auth resolves immediately as signed out (no
+     * boot spinner). Interactive sign-in is unaffected: a user who signs in
+     * through this provider (password, 2FA, or the "Sign in with Oxy" QR device
+     * flow) still commits a normal session scoped to this origin, which is all
+     * the IdP needs to drive its OAuth authorize/consent flow.
+     * @default true
+     */
+    coldBoot?: boolean;
 }